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Abstract — Engine-out (EO) is a condition that might occur 
during flight due to the failure of one or more engines. 
Protection against this occurrence can be called engine-out 
capability (EOC) whereupon significantly improved loss of 
mission may occur, in addition to reduction in performance 
and increased cost. 1,2 

A standardized engine-out capability has not been studied 
exhaustively as it pertains to space launch systems. This work 
presents results for a specific vehicle design with specific 
engines, but also uniquely provides an approach to realizing 
the necessity of EOC for any launch vehicle system design. A 
derived top-level approach to engine-out philosophy for a 
heavy lift launch vehicle is given herein, based on an historical 
assessment of launch vehicle capabilities. The methodology 
itself is not intended to present a best path forward, but 
instead provides three parameters for assessment of a 
particular vehicle. 

Of the several parameters affected by this EOC, the three 
parameters of interest in this research are reliability (Loss of 
Mission (LOM) and Loss of Crew (LOC)), vehicle 
performance, and cost. The intent of this effort is to provide 
insight into the impacts of EO capability on these parameters. 
The effects of EOC on reliability, performance and cost are 
detailed, including how these important launch vehicle metrics 
can be combined to assess what could be considered overall 
launch vehicle affordability. 

In support of achieving the first critical milestone (Mission 
Concept Review) in the development of the Space Launch 
System (SLS), a team assessed two-stage, large-diameter 
vehicles that utilized liquid oxygen (LOX)-RP propellants in 
the First Stage and LOX/LH2 propellant in the Upper Stage. 
With multiple large thrust-class engines employed on the 
stages, engine-out capability could be a significant driver to 
mission success. 

It was determined that LOM results improve by a factor of five 
when assuming EOC for both Core Stage (CS) (first stage) and 
Upper Stage (US) EO, assuming a reference launch vehicle 
with 5 RP engines on the CS and 3 LOX/LH2 engines on the 
US. The benefit of adding both CS and US engine-out 
capability is significant. When adding EOC for either first or 
second stages, there is less than a 20% benefit. 

Performance analysis has shown that if the vehicle is not 
protected for EO during the first part of the flight and only 
protected in the later part of the flight, there is a diminishing 
performance penalty, as indicated by failures occurring in the 


first stage at different times. This work did not consider any 
options to abort. 

While adding an engine for EOC drives cost upward, the 
impact depends on the number of needed engines 
manufactured per year and the launch manifest. There is a 
significant cost savings if multiple flights occur within one 
year. Flying two flights per year would cost approximately 
$4,000 per pound less than the same configuration with one 
flight per year, assuming both CS and US EOC. The cost is 
within 15% of the cost of one flight per year with no engine-out 
capability for the same vehicle. 

This study can be extended to other launch vehicles. While the 
numbers given in this paper are specific to a certain vehicle 
configuration, the process requires only a high level of data to 
allow an analyst to draw conclusions. The weighting of each of 
the identified parameters will determine the optimization of 
each launch vehicle. The results of this engine-out assessment 
provide a means to understand this optimization while 
maintaining an unbiased perspective. 


1 U.S. Government work not protected by U.S. copyright 

2 IEEEAC Paper #0000, Version 1, Submitted TBD, 201 1 


1 



Engine-Out Capabilities Assessment of 
Heavy Lift Launch Vehicles 


Jon Holladay 

NASA Marshall Space Flight Center 
j on.holladay@nasa.gov 

Keithe Baggett 

NASA Marshall Space Flight Center 
keithe.e.baggett@nasa.gov 

Chad Thrasher 
NASA Headquarters 
chad.w.thrasher@nasa.gov 

K. Scott Bellamy 

NASA Marshall Space Flight Center 
kelly.scott.bellamy@nasa.gov 

Stuart Feldman 

NASA Marshall Space Flight Center 
stuart.m.feldman@nasa.gov 


Abstract — A standardized engine-out capability (EOC) has 
not been studied exhaustively as it pertains to human-rated 
space launch systems. This work provides an approach to 
realizing the necessity of EOC for any launch vehicle system 
design, and also presents a systematic series of measures to 
assess the value of adding EOC to a specific system. A 
derived top-level approach to engine-out (EO) philosophy 
for a heavy lift launch vehicle is given herein, based on an 
historical assessment of launch vehicle capabilities. The 
methodology itself is not intended to present a best path 
forward, but instead provides three parameters for 
assessment of a particular vehicle. 1,2 

Of the several parameters affected by this EOC, the three 
parameters of interest are reliability with sub-parameters of 
Loss of Mission (LOM) and Loss of Crew (LOC), vehicle 
performance, and cost. The intent of this effort is to provide 
insight into the impacts of EO capability on these 
parameters. The effects of EOC on reliability, performance 
and cost are shared, including how these important launch 
vehicle metrics can be combined to assess what could be 
considered overall launch vehicle affordability. 
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1. Introduction 

Engine-out is a condition that occurs during flight due to 
the failure of one or more engines. Mitigations to engine- 
out condition can be called engine-out capability (EOC), 
whereupon significant improvement to loss of mission 
(LOM) estimates is possible within reasonable 
performance and cost penalties. 

During the early development activities of the Space 
Launch System (SLS), EOC was evaluated in support of 
achieving the first critical milestone (Mission Concept 
Review). A team assessed two-stage, large-diameter 
vehicles that utilized LOX/RP (liquid oxygen/kerosene) 
propellants in the first stage and L0X/LH2 (liquid 
oxygen/liquid hydrogen) propellant in the second stage as 
shown in Figure E 

Evaluation of historical flight data allows an estimate of 
failures resulting in the loss of thrust from one or more 
engines during ascent. Here, it was seen that 
failure/shutdown of an engine was typically the 
consequence of events external to the engine proper (e.g., 
propellant feed system), as opposed to catastrophic failure 
of the engine itself. Regardless, the probability of engine 
failure due to all causes was examined due to its role in 
LOM estimates. 

With multiple large thrust-class engines employed on the 
stages, protecting with EOC was found to be a significant 
driver to mission success. This analysis offers insight into 
the significance of inclusion of EOC for SLS, with 
extensibility to other heavy-lift launch vehicles. 
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Figure 1. Reference Heavy Lift Launch Vehicle 

It is the intent of this study to compile an abbreviated list 
of these common EO occurrences and predicate a 
procedure by which a launch vehicle system can weigh 
major factors to determine the criticality of EO 
capabilities. The study focuses on the impacts of EO 
capabilities as they affect reliability, vehicle performance, 
and cost. 

2. Engine Failure Probability 

When a vehicle failure is due to the engine, it is important 
to understand whether the failure mode is endemic to the 
engine system or externally induced. This section briefly 
discusses estimation of engine probability of failure as it 
pertains to this effort. 

The largest indicator when determining the probability of 
engine failure is chamber pressure (Pc), as it directly 
correlates to delivered thrust. To realize increasingly 
higher levels of thrust, increased complexity engine 
cycles are required to achieve higher chamber pressures. 
Thus, as a system evolves from an expander cycle to a 
staged combustion cycle, the level of complexity 
increases (e.g., turbopump requirements), thereby 
worsening the predicted probability of failure. While 
Table 1 shows this general trend for hydrogen engines, 
the same trend holds for RP engines. Pressure-fed systems 
were not considered (only pump-fed), nor were other 
propellant combinations (e.g., LOX/methane). 


Table 1. Estimated Probability of Engine Failure 


Engine 

(LOX/LH2) 

Cycle 

Pc 

[psi] 

Predicted 
Failure 
Rate 
(1 inN) 

RL-10 

Expander 

350 

1942 

J-2X 

Gas Generator 

1340 

1070 

RS-68 

Gas Generator 

1450 

756 

SSME 

Staged 

Combustion 

2750 

621 


(Note: “1 in N” is the reciprocal of the probability value, assessed at 515 
seconds total duration) 


Engine-specific failure rates were obtained by examining 
the component-wise probability of catastrophic failure 
against a basis established by the Space Shuttle Main 
Engine (SSME) 2000 Quantitative Risk Assessment 
System (QRAS) study. Table 2 indicates how each engine 
component ranked in terms of individual probability of 
catastrophic failure on SSME Block II. 


Table 2. SSME Block II Catastrophic Probability of 
Failure Drivers 


Component 

% of Total 

High Pressure Fuel Turbopump 

24.78% 

Main Combustion Chamber 

16.62% 

Other Risk 

16.23% 

High Pressure Oxidizer Turbopump 

14.52% 

Nozzle 

9.99% 

Fuel/Hot Gas System 

4.26% 

Main Injector 

4.01% 

Pneumatic System 

2.77% 

Oxidizer System 

1.80% 

Low Pressure Oxidizer Turbopump 

1.64% 

Oxidizer Prebumer 

0.86% 

Heat Exchanger 

0.73% 

Low Pressure Fuel Turbopump 

0.42% 

Actuators 

0.38% 

Powerhead 

0.37% 

Fuel Preburner 

0.31% 

Valves 

0.30% 
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The detail underlying Table 2 is used directly in 
determining the “1 in N” statements given in Table 1 
through a SSME Probabilistic Risk Assessment (PRA). 
Here, the QRAS contributions at the component level 
were appropriately aggregated to generate the engine 
system level probability of failure. The PRA accounted 
for SSME demonstrated reliability through application of 
a Bayesian statistical methodology with an “informed” 
prior distribution. The resulting estimate is then adjusted 
to contain a 30% margin. 

To extend the analysis to other engine systems, 
government and industry subject matter experts arrived at 
scaling factors to apply at the component level. Therefore, 
it is recognized that assumptions on subsystem design can 
affect the estimated probability values when extending the 
stated basis to analysis of other engines. For example, an 
oxygen-rich staged combustion (ORSC) cycle is generally 
considered as having greater risk due to higher 
temperatures and material issues in an oxygen-rich 
application. Table 3 illustrates how the assumptions of 
robustness for engine subcomponents can affect estimates 
on an engine cycle that, in an uninformed case, would be 
construed as having a higher probability of failure. 


Table 3. Engine Subcomponent Example 


Engine 

Fuel 

Cycle 

Pc 

[psi] 

Predicted 
Failure 
Rate 
(1 inN) 

RD-180 

Kerosene 

(RP) 

ORSC 

(LOX- 

rich) 

3860 

629 

SSME 

Hydrogen 

(LH2) 

FFSC 

(Full- 

flow) 

2750 

621 


In Table 3, the greater robustness (lower speed, less 
leakage potential) of the RD- 180’s high pressure fuel 
pump significantly minimizes the basis value derived 
against the SSME’s high pressure fuel pump, resulting in 
nearly identical failure estimates for the engine system. 
For clarity, the catastrophic failure probability of the RD- 
180’s high pressure oxidizer turbopump and hot gas 
system were assessed as 50% greater than the basis values 
due to the oxygen-rich environment. 

In using these failure probabilities for assessing the need 
for EOC, the question of when to begin protection arises. 
Figure 2 is based on SSME test data and notionally 
illustrates the failure probability as a function of 
accumulated engine operation. Here, it is seen that 
“Catastrophic” failure is treated a constant risk and 
precludes EOC by definition. However, “Shutdown” is a 
decreasing function with the highest probabilities 
occurring early — “Infant Mortality.” Given that liquid 
engines experience at least one acceptance test at full 
mission duration prior to flight, and are verified 


functioning in the final seconds prior to lift-off, one could 
make a convincing argument for a delayed EOC (e.g., lift- 
off + 20 seconds); thus, acknowledging the encroaching 
“Wear Out Risk”. 
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Figure 2. SSME Acceptance/ Testing Failures 
(Notional) 

Further, failures of the vehicle system are often assumed 
to be directly caused by failures of the engine while this 
may not be the case. Table 4 shows data from a launch 
vehicle study [1] that assessed engine failures from 1980 
through present day which indicates that the Main 
Propulsion System (MPS) has been the leading cause of 
failure, not the engine. 



Notional Wear Out Risk 


Shutdown - Infant Mortality 


Catastrophic - Constant Risk 


Table 4. Subsystem Interactions 



Manifesting Subsystem 

Engine 

MPS 

GNC 

Thermal 
Protectio 
n System 

Staging 

Total 

Initiating Subsystem 

Engine 

3 





3 

MPS 

10 

1 


1 


12 

Guidance, 
Navigation 
& Control 
(GNC) 

2 





2 

Unknown 

1 





1 

Structures 





1 

1 

Electronics 

3 


2 



5 

Grand 

Total 

19 

1 

2 

1 

1 

24 


Thus, engine-out may not just result from an engine that 
fails, but could also result from issues not endemic to the 
engine. There is always some probability of failure 
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whether the vehicle is protected against engine-out or not. 
With this in mind, the next step is to assess the 
affordability that EOC allows, in terms of reliability, 
performance, and cost. 

3. System Effects of EOC 

The following discussion reflects the three figures of 
merit (FOM) assessed for EOC: reliability, performance 
and cost. Though the approach uses specific launch 
vehicle configurations, the philosophical discussion is 
intended to provide an approach to assess the overall 
effects of EOC on any given vehicle configuration. 

Reliability 

The reliability assessment performed by Safety and 
Mission Assurance (S&MA) found that the LOC and 
LOM numbers for a single stage EOC were roughly 
equivalent. The S&MA community chose to emphasize 
Core Stage (CS) EOC for crew safety. Employing CS 
EOC from lift-off through stage separation increases the 
likelihood of a successful tower clearance and provides 
the ability to delay an abort until the vehicle has passed 
beyond Mach 1 and when the vehicle would experience 
the maximum dynamic pressure. This would allow for a 
successful Multi-Purpose Crew Vehicle (MPCV) abort if 
needed. The following radar plots show the LOM and 
LOC impacts for 160 ft CS/100 ft Upper Stage (US) fixed 
frame vehicles, assuming 5 RP engines and 3 LOX/LH2 
engines respectively (5-3), compared to 7 RP engines for 
the CS and 5 LOX/LH2 engines (7-5) for the US. These 
vehicles were analyzed in three flight scenarios: a CS 
engine failure, an US engine failure, and both a CS and 
US engine failure. 



US EO 


Figure 3. LOM EO Impacts 

LOM and LOC are improved as EOCs are added to the 
vehicle, with the best result given when both stages 
employ EOCs. The 1 in N estimates given in Figures 3 
and 4 indicate the probability of a LOM or LOC assuming 
various EOCs. The findings of the reliability modeling for 
LOM indicate that the two heavy lift launch vehicles 
performed similarly, with the 5-3 vehicle offering 29% 
more protection than the 7-5 vehicle sans EOC; 31% 


more protection assuming that just the CS is protected 
with EOC; 25% more protection assuming that just the 
US is protected with EOC; and an overall increase of 18% 
protection when both CS and US are modeled with EOC. 

Generally, adding engines to either stage without any 
EOC reduces the overall LOM for the vehicle. The 
reduction is due to single engine reliability being a driver 
in the overall vehicle model. Another way to summarize 
this effect is that the complexity of the engines reduces 
the overall vehicle reliability. 

Modeling shows that the LOM estimate of any particular 
configuration is roughly the same when either the US or 
CS is designed to have EOC. The LOM estimate for a 
stage exhibits a high degree of correlation between the 
product of the number of engines on a stage and the 
estimated burn time. As expected, when both the US and 
CS have EOC, the LOM estimate is far better than 
without EOC, in all cases, as shown in Figure 3 where the 
LOM estimate is approximately 1 in 400 for either vehicle 
when EOC is assumed for CS and US. 

Figure 4 illustrates the LOC impact of EOC for the same 
three flight scenarios: a CS engine failure, an US engine 
failure, and both a CS and US engine failure. The 5-3 and 
7-5 vehicles trend in the same direction with LOC 
improvement as EOCs are added to the vehicle. It can be 
seen that LOM is affected more than LOC, when the EOC 
is increased from No EOC to CS and US EOC. 


No EOC "5-3 



Figure 4. LOC EO Impacts 

Modeling shows a significant shift in the failure modes 
based upon the type of EOC. The 5-3 vehicle showed that 
roughly 19% of CS engine failures and another 19% of 
US failure modes were uncontained engine failures. 
Uncontained engine failures have the lowest rate of 
successful crew abort for both the Core and Upper Stage. 
Therefore reducing the fraction of uncontained engine 
failures increases the probability of LOC, described as a 1 
in N estimate, through a successful use of the abort 
system. For example, if the baseline of the 5-3 vehicle 
configuration had a 1 in 1000 LOC, then the 5-3 vehicle 
with Core Stage EOC would have roughly a 1 in 1107 
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LOC. Table 5 shows the relative improvement in the LOC 
estimate and percentage of uncontained engine failures by 
stage and combined for the four cases of a 5-3 
configuration. 


Table 5. Uncontained Engine Failures 


Config. 

LOC 

(~%) 

Uncontained Engine Failure (as %) 

Core Stage 

Upper 

Stage 

Total 

No EOC 

100 

19 

19 

38 

CS EOC 

120 

3 

23 

26 

US EOC 

122 

23 

1 

24 

cs&us 

EOC 

154 

4 

1 

5 


Performance 

The performance cost for protecting for engine-out varies 
widely. Each vehicle configuration has a nominal 
performance value and as such, the delta in Figure 6 
shows that there is an overall smaller engine-out impact 
on the 7-5 launch vehicle. With EOC gradually added, the 
performance impact on the 5-3 vehicle increases until the 
loss is 52 tonnes of performance with both CS and US 
EO. Despite more engines on the 7-5 vehicle, the EO 
impact is less due to the greater overall nominal 
performance. 



Figure 6. Vehicle Performance with EOC 


To investigate the performance significance of CS engine 
failure through modeling, a single CS engine was failed at 
different predetermined times during flight. It was 
determined that the worst-case engine failure scenario 
occurred when removing an engine’s contribution to 
performance for the entire flight of the stage. Propellant 
was removed from the CS tanks as a result of trade 
studies, in order to meet the 1.2 thrust-to-weight ratio 
liftoff requirement, while propellant was removed from 
the US to maximize payload. The modeling showed how 
much payload could be taken to a given orbit, assuming a 
CS engine was lost at a certain point in flight. The result 
was very little performance penalty if the vehicle is not 
protected for CS EO in the first part of flight (-first 20 
seconds), especially if the payload mass is not maximized 


on the vehicle, suggesting that the target orbit could still 
be reached. This presents the option of challenging the 
need for EOC from the pad, since it is not likely that the 
launch would proceed if an engine did not ignite on the 
pad. 

Cost 

In addition to reliability and performance, launch cost is 
frequently a driving parameter that anchors a launch 
system to a schedule, and reflects the desires of the 
current political environment. 

There is a one-time cost associated with choosing a 
launch vehicle. The Design, Development, Test and 
Evaluation (DDT&E) cost was derived assuming one 
rocket type, with the Production and Operations (P&O) 
cost dependent on the launch manifest. The cost 
differential is the number of engines manufactured 
annually. 

EO capabilities were also assessed for multiple flights per 
year, as shown in Figure 7. For the 5-3 vehicle 
configuration launched once per year, the CS EOC 
increases the cost by nearly 25%, with only a slightly 
larger increase for US EOC. The largest decrement to cost 
is employing EOC on both stages, resulting in an 80% 
cost increase. 

If the launch manifest assumes two flights per year, the 
initial cost for no EOC is cut by 40%, resulting in a lesser 
overall cost decrement when engines are added for EOC. 
Additional flights may be required for low marginal costs. 



Figure 7. Multiple Flight “5-3” Vehicle Cost with EOC 


Affordability 

The three parameters discussed are the primary factors 
affected by EOC. However, the impacts to each parameter 
individually mean little if they are not integrated to assess 
affordability. For the reference vehicles used in this study, 
Figures 8 and 9 show that the EO impacts for CS and US 
are roughly equivalent in all four parameters, noting the 
P&O cost is higher to produce more engines for the CS. 
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Figure 8. CS EO Impacts 



Figure 10 shows all of the parameters influenced by EOC, 
specific to the baseline 5-3 vehicle, but generally 
indicative of these parameters for any vehicle. LOM 
improves significantly by adding EOC on both CS and 
US, decreasing the risk by nearly a factor of five. The cost 
and LOC results are as expected, with P&O rising with 
the addition of engines, and the LOC value improving as 
EOC is added. 


determine how much the other parameters may be 
compromised. 

4. Conclusion 

The presented approach addressed the need for an EOC 
assessment as it pertains to a human-rated space launch 
system. While the numbers given in this paper are specific 
to a certain vehicle configuration, the process requires 
only a high level of data to allow an analyst to draw 
conclusions. The weighting of each of the identified 
parameters will determine the optimization of each launch 
vehicle. The results of this engine-out assessment provide 
a means to understand this optimization while 
maintaining an unbiased perspective. 

Optimization on certain metrics will affect the choice for 
EOC. In this study, it was determined that LOM results 
improve significantly when assuming EOC for both CS 
and US. EOC on either stage will improve LOC and 
LOM, but EO on the CS has additional benefits. 
Additionally, performance analysis showed that if the 
vehicle is not protected for EO during the first part of the 
flight and only protected in the later part of the flight, 
there is a diminishing performance penalty, as indicated 
by failures occurring in the first stage at different times. 
This work did not consider any options to abort. The 
benefit of adding both CS and US EOC is significant from 
a reliability perspective, and while adding an engine for 
EOC drives cost upward, the impact depends on the 
number of engines to be manufactured per year with a 
given launch manifest. Once a vehicle configuration and 
manifest is selected, cost trades can be performed against 
safety and mission to determine EOC requirements. 

The next step is to decide when to enact EOC during 
build. Implementation may be during the design of the 
MPS, during the installation of an additional engine at 
Michoud Assembly Facility (MAF), or prior to shipment 
to Cape Canaveral. 



Figure 10. CS and US EO Impacts 


The intent of the study is to allow this type of EO 
assessment to extend to other launch vehicle systems, 
including heavy-lift and commercial vehicles. Overall, the 
weighting of each of the identified parameters determines 
the optimization of each launch vehicle. The way in 
which a vehicle is optimized is a significant factor when 
assessing for EOC. 

5. Forward Work 

The approach presented for this EOC assessment was 
purposefully designed with a top-level perspective, and as 
such there are several areas that would require further 
efforts. 


It is clear that the biggest LOM benefit is CS and US 
EOC, since there is less than a 20% benefit of employing 
EO on either of the other stages. However, if the vehicle 
is optimized for reliability, it is up to the design team to 


Other analysis models may be generated to assess abort 
conditions that should conduct tradeoffs between 
successful missions versus successful aborts. In addition, 
there are multiple ways for guidance to respond which 
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would increase the chance of launch success and result in 
lower performance penalty. Evaluating emergency throttle 
settings run during contingency situations would also 
offer insight into response time and help to dictate the 
need for additional engines and thus EOC. 
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Presentation Summary 


♦ Introduction 

> Objective 

> Background/Historical Perspective 

♦ Engine Failures 

> Probability of Engine Failure 

> Engine-Out Drivers 

♦ System Effects of Engine-Out Capabilities 

> Reliability 

> Performance 

> Cost 

> Affordability 


♦ Summary of Results 


Preamble 


♦ NASA assessed many potential options for the Space Launch 
System which could meet the budget, schedule, and performance 
requirements as given in the NASA Authorization Act of 2010 

♦ A series of in-depth technical and business-case analyses & 
studies were conducted by government and industry experts 

♦ The SLS architecture currently in design and development was the 
sole solution that met the following major requirements: 

• First launch in 2017 

• Use current contracts, workforce and infrastructure 

• Very constrained budget 

♦ The results presented in this paper and presentation by 
Requirements Analysis Cycle 1, Team 2 are given in historical 
context only. This is not a revisiting of the decision made by NASA 


SLS Roadmap 


ACTIVITY 


JASOND JFMAMJ JASOND JFMAMJ JASOND 


Review of Human Space Flight (HSF) Plans Committee (Augustine Panel) 
Heavy Lift Launch Vehicle (HLLV) Study 
Heavy Lift Propulsion Technologies Study (HLPT) 

Human Exploration Framework Team (HEFT) and HEFT II 
Broad Agency Announcements (BAA) 

NASA/U.S. Air Force (USAF) Common Engine Study 
Heavy-Lift Vehicle (HLV) Analysis of Figures of Merit (FOM) 

Requirements Analysis Cycle (RAC) 1 
SLS Mission Concept Review (MCR) 

Exploration Systems Development (ESD) SLS Analysis of Alternatives (AoA) 
Agency Integrated Architecture Decision 

SLS Program Planning and Budget Execution for FY13 to Agency 
SLS Acquisition Strategy Meeting 

Independent Cost Assessment Report (Booz Allen Hamilton) 

SLS Rolled out by NASA Administrator 



Introduction 


♦ Objective: A derived approach to EO philosophy based on an historical 
assessment of launch vehicle capabilities 

♦ Background 

> Historical Perspective (Engine-Out Capable Missions) 

Apollo 6 
Apollo 13 
STS-51-F 
STS-9 




Subsystem Interactions by Failed Stages 


Subsystem reliability is not the only driver for launch success 

• The interactions/dependencies of critical subsystems is very important-over half of all 
failures propagate to a different subsystem 

• Liquid stages have more tightly coupled systems than solid stages 



Manifesting 

! Subsystem 

engine 

MPS 

GNC 

TPS 

staging 

Total 

Initiating Subsystem 

engine 

3 





3 

MPS 

10 

1 


1 


12 

GNC 

2 


0 



2 

unknown 

1 





1 

structures 





1 

1 

electronics 

3 


2 



5 

Grand Total 

19 

1 

2 

1 

1 

24 


“Liquid and Solid Propulsion, 2011” 
Safety & Reliabiility 
Donovan L. Mathias, Ph.D 
NASA ARC 


Integrated propulsion system may manifest the failure, but the 

initiating aspect may be elsewhere 



Engine P fai | Ure Drivers 



♦ Combustion cycle is most prominent influencer to P f within a 
propellant combination (LOX/RP, LOX/H2...) 


Engine (LOX/H2) 

Cycle 

Pc [psi] 

Pred Failure Rate (1 in N) 

RL-10 

Expander 

350 

1942 

J-2X 

Gas Generator 

1340 

1070 

RS-68 

Gas Generator 

1490 

756 

SSME 

Staged Combustion 

2750 

621 


• More complex cycle needed for higher pressures 

• Subsystem design margin influences P f estimate 

— RS-68 turbopumps penalized heavily compared to J-2X 

Example! Lox-rich Staged Combustion (ORSC) typically seen as having greater risk 
due to higher temps and materials compatibility issues, but... 

— Assumed robustness of subcomponents can influence the difference 


Engine 

Fuel 

Cycle 

Pc [psi] 

Pred Failure Rate (1 in N) 

RD-180 

Kerosene 

ORSC (Lox-rich) 

3860 

629 

SSME 

Hydrogen 

FFSC (Full-flow) 

2750 

621 











Engine P failure Modes 



SSME Acceptance/Green-run testing filters failure modes 


V 
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Notional Wear Out Risk 


l.E-06 


Shutdown - Infant Mortality 


Catastrophic - Constant Risk 


0 200 400 600 800 1000 1200 1400 1600 1800 2000 

Seconds of Continuous Operation 


Engine P failure Core Stage 



♦ A single Core Stage engine 
was failed at different 
predetermined times during 
flight 


♦ 1607100’ 7-5 nominal case 
included throttling to alleviate 
high max q; When an engine 
failed the remaining engines 
were throttled up. 


Performance Penalty with Core Stage Engine Out at Different Fail Times 



Time at Engine Fail (sec) 


System Effects of EOC 



33.0' 




L 


33. O' 



iZ5ZX_L 0 _Q. 


400.0' 


350.0' 


260.0' 


160.0' 


♦ Reliability 

♦ Performance 

♦ Cost 



Reference Heavy Lift Launch Vehicle 



Affordability 


System Effects of EOC: Reliability 



(Units given as 1/N probability) 


Config. 

LOC 

(~%) 

Uncontained Engine Failure (as %) 

Core Stage 

Upper 

Stage 

Total 

No 

EOC 

100 

19 

19 

38 

CS 

EOC 

120 

3 

23 

26 

US 

EOC 

122 

23 

1 

24 

CS & 
US 
EOC 

154 

4 

1 

5 


♦ FF vehicles run with EO cases 

• No Engine Out 

• Core Stage Engine Out 

• Upper Stage Engine Out 

• Both 


No EOC 



■ 5-3 

“ 7-5 


CS EO 


System Effects of EOC: Reliability Cont’d 


♦ Core or 2 nd stage EOC roughly equivalent LOC/LOM 

♦ Core EOC from lift off selected 

• Increases likelihood of successful MPCV abort if needed 
- Pushes past Mach 1 and Max-Q 


♦ Engine throttling allows one configuration for multiple payloads - 
increasing the ability to track overall vehicle performance 


System Effects of EOC: Performance 




♦ FF vehicles run with EO cases 

• No Engine Out 

• Core Stage Engine Out 

• Upper Stage Engine Out 

• Both 

♦ Delta is the engine out case minus 
nominal performance. 

• Different nominal performance for each 
individual vehicle configuration. 


CS EO 


US EO 


CS & US EO 


♦ Engine out impact is smaller on the 7-5 


System Effects of EOC: Cost 


“7-5” Vehicle 


“5-3” Vehicle 



o 

w 

1-1 

o 

£ 

CO 

O 

o 

<D 

N 


o 

£ 


2 

1.8 

1.6 

1.4 

1.2 

1 

0.8 

0.6 

0.4 

0.2 

0 


One flight per year 
■ Two flights per year 


i ■ ■ 


X 


No EO 


CS EO 


US EO 


CS&US 

EO 


♦ One DDT&E assuming one rocket type is built (e.g. 5-3 instead of 7-5) 

♦ P&O depends on the manifest 

♦ The cost differential is the number of engines manufactured annually 


System Effects of EOC: Affordability (5-3 LV) 




US EO 




System Effects of EOC: Summary 






When To Design for EOC 


♦ Decide to design for EOC 


♦ Decide when to enact EOC during build 



Reliability 

Performance 

Cost 


Design MPS with blank-plate 
Install additional engine at MAF during assembly/build 
Protect for EO prior to shipment to the Cape 
Protect for EO after shipment to the Cape 


Design for EOC and choose when to implement 


Findings 


1. EOC (Both CS and US) offers a significant LOM improvement 

2. If vehicle is not protected for EO in the first part of flight and only 
protected in the later part of flight, there is very little performance 
penalty 

3. Mission and crew safety should be evaluated to determine EOC 
requirements once a specific vehicle configuration and mission are 
selected. 


Summary of Results 


Cost 

♦ Number of engines manufactured per year is the cost driver, since DDT&E and P&O will 
remain the same for each engine 

Reliability 

♦ Engine-out capability on either stage will improve LOC/LOM, but EO on the Core Stage 
has additional benefits 

Performance 

♦ 7-5 engine out has smaller impacts than the 5-3, especially for an US engine out 

♦ New data indicates that most failures originate in the MPS not in the engine, but manifest 
in the engine. 


Conclusion: Affordability is dependent upon the number of engines per vehicle; 
As engines are added, LOC/LOM & Performance improve while Cost increases 


